Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
60d5a779491a31b4183daeb9b59d6eb3_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
60d5a779491a31b4183daeb9b59d6eb3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
60d5a779491a31b4183daeb9b59d6eb3_JaffaCakes118.html
-
Size
51KB
-
MD5
60d5a779491a31b4183daeb9b59d6eb3
-
SHA1
4d554e1210d46e9b51c40022189eb15a912cbc34
-
SHA256
bac22963c2bc021b9fb358bf95d218a93c876c477d381ac23998081329bd4853
-
SHA512
79cd99ddc020d2d79950db3b1abcf4aa9b5e2fdf7f5c6deeee85cb75418bce1ac3a52ea1d5646fd4f08d732f260a99f257842d409b37e5d267b908952e13b0df
-
SSDEEP
768:Su/YR49z3ZNh7YsxuaFvG/Es7nmu4eyTP9BzTJwLY6uwjg:Su/l9bfisxu8kmu4eSPfiM6uwjg
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000092ac7f6319e9838e1c619e4dae01999b9275ce670213439a6c56a58d8ba1e190000000000e8000000002000020000000aa7a53c1a9eb8a1ebee1a1cbd8b65f3bdd78a75b25e44640450be8fa48a8cd8020000000c6829a56985a0fea27339f69b236f74786414e71f45807ade09206b97746012740000000cc2e1fddd0bc8798de3d62549d2c268fcb0ddf50875e10284cc97889dc362a1dece26c6085c74231114b382046b14ae10c3c2f30871df3d415319b64bb42c0ff iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000ddc4ec330c586f8108fa210f002abd5d5962c5cc45f87763246b618790c53118000000000e80000000020000200000005f75d4a1e0ce7103fd12c4d9bbdcad7a66d814e02e6efe654f83a0a3db77bbb590000000f0b3776adf7cdc9d11cc80a8a19f276c485481e81b14c24e07b393cdb1ef2e7acdfffb4a4894bcf2d21eae18132275529d61d764bd035361629b3de277ff5cbae107a78981a2789d13baa61aa18a762b974d2d3fcce20d6af1db365a1601e97863578a17f66aa8caba7d4d71f2320784cb3c51833ea6b5a7a608e3c7d00cd89a835edb07d0f8916d1984667fd3b0b9d540000000bbfb25b7af582abd7a8307531482eaa30778783dfce82e1fb42175a453ffe7be33b37890e2ccf1e349a70ebd6bfd7382a68d0c82d6102fcc4d4368209ea2b132 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b072f0a3f3aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422398502" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0EE3761-16E6-11EF-AE27-76C100907C10} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2324 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2324 iexplore.exe 2324 iexplore.exe 2752 IEXPLORE.EXE 2752 IEXPLORE.EXE 2752 IEXPLORE.EXE 2752 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2752 2324 iexplore.exe 28 PID 2324 wrote to memory of 2752 2324 iexplore.exe 28 PID 2324 wrote to memory of 2752 2324 iexplore.exe 28 PID 2324 wrote to memory of 2752 2324 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\60d5a779491a31b4183daeb9b59d6eb3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5ee335c188387cc88f338f80b14c50b
SHA1560c7310bf397ef2d9f31fd67eb798f5a4e6b648
SHA2564897748fe855267e286e4455e6c2a44ea0f08eed0c14aad4b15ee5d8a46b0f78
SHA5123cdcb98c7f6437030947f1edc672d7880c38bbd2cf28b7cb80a5d85a800384e25417b15cd7e052c5b30ce2fe3a870a5281d05a62177ce55366ade9c8ca11820e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5527d96bbe41e382359c77aebbeeb55b4
SHA13904753e53056f9281ea700c932035e7b521e4aa
SHA25639e6e1b6f41edcde0d242f4c9ddd4907f7e3e40465d288c8cb672f1815a18459
SHA51246c2bcff53205ed6d2a9efa07d4d806d0fe7a697b97841817152a75d9af909bcd1a5dc7b76dda3884424123479ffe8104997fb42be0277b814597a776898d7f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590892f347067a7be3f5a4d2071e8e2cd
SHA1a6fc801854dcedb024f510a10875b9eae53cdba4
SHA2561fc522074669933f6db9e5f2ced1b5a9ce5e8988c85d8deff82efcc9a9288a92
SHA51279040bff1108974fef6ae449ddea1a12ae613ad6fab53bb0fc8ef311409509d9c4a8cf6246baac992e52a3075a446404d6908c1eb49a7bbbe0bab3caf7e37f71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd53eb03b0e93e38c2c475f77314159e
SHA12923204e262ce3d8f86983bf418166a6a214c262
SHA256694e36b44fd2e0e35217cb6e97f9060120a1b53de20ba27ce8a000fa897c409e
SHA512e98d058becdf18fb6c977342ad4cf48fce1551189aa4ee0b8f511c8a90e08e5fa8b1a01c00c38e74e3fa82c39f21461bde43d925f521350bc5f6e6ed89bafc3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564ce47a51f94b417de234b3e3233d71f
SHA13e1a35404a0964978cdac5dbf759838f59f69a8a
SHA2566e1534734b1a98e3c2661a93211e8e932263ee4fda09ecc5ef9e797632e9ac59
SHA512f9b7a7c0ecceffe1e4ff8fb2f1cd4bd9c33bba003c4cdb7a328157197bdcb874a63c3e3d3d0292fd58131c4fb7127d5c5e8ab792795dbe8627d15dd8e483480a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595c2e474f96cb7ae56c807979111c200
SHA1da0a3ed4b1819b3606726005afa647ab87a88cc7
SHA25620e85a22bb568f7076e4d830bc61feab91f81de1b4261945c05c1fe606852bcf
SHA512c462d7a9babb7ad98240ce1a1407175f59fcb836a9a41234334dba60e0d7b08bb1bd1305c8496871c129ca3b11b4ae4fc8144fd9e45569a4688668630c690ae9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2b6077a89456ee75a7d0fefdcb2e71f
SHA1a939a366020c38650d06bd5d397ccc8b6da31d4d
SHA2567078e5ee09043e9af61337adc089d3675f48e4e1e3ca6fc5892394ca869c8cc0
SHA5122b67927c5d31da157a4ee33ff3d0c05a3cbd8217c011be030f71d1ef48bb19d48d9bb69d4fe1b916979903ac35b3d8e8e659f05a043b6d7d06b1db3977b0a6f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb3d4747031b25c0736b9f9259082439
SHA13b2fc649f86267ba512ee14fe1a5be211cdfd3e0
SHA256c81b49c844c25278d02156a7fb728d6feb11ac24bad610269f7c58e94f520450
SHA5124d3518752a5d3287fe4f371b987fc08684c5c82e3abe0d7a9877a0f12d3961c3521f428af42b3b2a05f972c243e2c77980934a5550f4e075052eaadf1fa08d68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523900227566b6cca8a3c515bde4e2975
SHA1b1d2c84c20a2e79b5c6b3018f8494800737872f1
SHA256b6198ab70859c2904ca115843d5d7f32a190ab5cbff01122079c4a9adcdc13f8
SHA512043c9c6f5976fd0d48bc021ef79c0deff5e618126acb46c3ade2dff76c867e2b89eb90b14813b760d2718e514132af9358ab30d681b961be37a69184a834796b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ab2c34dea8761a45322525c59dac649
SHA1d37997ce45d7c7ea52c068495ff5588f1617fb6a
SHA256ac579354c41fa8d461f06a0c8db9766fde504ad69b5502e30391895608b62b3a
SHA512a8d610a409c81920a2c247324c566542beca556e68359b16d78de0e2d26b7e03676987544d2ec3e61607542c5e2761201400c94c082c8a90fbc030667aa3b847
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fde5d498a37dd776df518add43824ec6
SHA1e4fbc702be916a224e945800b65e6ca19209b7fc
SHA256d43c61da8a5c7f13be0819476b6d923c9a48153f344231b27e98f74b4902f7bb
SHA512f778fe1b5724035308d41c958bd19dbcba200b698c03509537dadb0d3a62cd414882b3459a3650be55091dd559cd7a18049ff17c988c463685db9b92fc85a2ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56989a5860fc1634fffec808c6b60a48b
SHA1addd8a773c4d07f02eda28fda047e967dcbdd99e
SHA2569ed508c389f752c17630c3a1c177fcc93be99d2a1a8cf3efc651c2272880de2b
SHA512dc97c266621913474c0ca5b4a78af16f180f1c54f164f9ece21fdbcb665a74ac2ac9920466e888dd52e3f3b5a9d0830a594e22997b72e30ec767bd0d24e14c89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cbe5971f9ba37951f2cef27476bca1e
SHA1c0a9f83db1d3221ebadfc9322e4ad04d53ec7480
SHA25698b222d4ccd6a46958ebfbc2963008d5cc96e21a326ce442d383a9e7d89a7b6c
SHA512fc5bdafc3b7a75640a9066eb683ce05272cffcd954694750da6bee2e469e6c9b03b85ee7697415fcf0b90f3822e5cc7e0cdf4a147131486e640cedc444e6340d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea956b1497575a49587cd26919aee4d8
SHA10e5f8ff2233a70cb3978910f5d919034057886c4
SHA2562c7e7cb0a6da829428ba127af17fd4eda6727bf7261ec0f5d7a2a1771bb6da2b
SHA5127267f3677e7a441bfa952d8e750f5ec00035a77c5b3ee32c20e5de347b5e215567ab6fc59f0a425cbadf5cfe078ab84750c07a2e4ddfdf768ed046fe96711660
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5513906b90ae3a9c2eb2d47aeddfbbdb0
SHA134b604415e0163d28d5f9bced67bf89bf7e211d4
SHA2561d75810ce5dfb1f2c93395f341524f3450c4969ff2999e91f26f66fe6dc7d3ec
SHA5123bc587fb220980c6adbee3cc82f225a7ae5ea095b121d3f34642d7cd21375e0a8dbac2798a5aa8ab2b6d8355f098b8648348bc64513212ae9826dc9c20c519c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dd24bdd0c10b0365e239ed77d1c0c46
SHA173d77b61b577d992bc14533e32af48faf2a2b4c6
SHA25672cb2de85249e1314cb0b66bc4b91b7b9c8be60c09a6de8122eb196f77343795
SHA512f9c51b42fae7eb4117c76c4f278eec79c9007ec51f9414b4fde6ba3c67a1943b211bd33e46a97568bd6208323cd5fed04fcbbcd8a0204881f9d3677e39bcefa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51668902fe0b920e9a539c343f1580e83
SHA194f27f36d2b9496e9d1b23f81aa0830654b40bd5
SHA2566de6866856250f11ee8d4cf4ffca510c7ce509fde2a42f7fc7161d88eee4b61f
SHA51211029573e6b28cefc04325a4e085a77a892ccb0d4e4f2b7527893a06e760276cfd403aed8d38568ccba23e1e3f7bacca0b3b877d86ab9ab7bf0a79264685f8c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5f1ec46a75709a2bc58800358fb77be
SHA1f0f06c461202d8f7cb3a7fc1c6497ff4f25b79e5
SHA2565b757dd782f53d8e8e1476c92f9cdad321240d13d6dfc87467ad0286cb635c20
SHA5122d3883c7aee941480850574dd92ff7ffb2de592b620084c65364d85cecce37762481e1463a207438aa3c4ae837aebe1d508773f648d0fe92361bdd2a773a444b
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a